penpot-bridge

penpot-bridge is a skill for Claude Code from lync-cyber/CataForge. It costs 122 tokens per session (2,333 once invoked), scanned B, original, MIT.

A bridge between Penpot, a tool for designing interfaces, and frontend code. It can read design structure and styles, synchronise design tokens, generate component skeletons, and check whether code matches a design.

In plain words
What is it for?
Use it to inspect Penpot components, sync values such as colours and spacing, create starter component files, or review an implemented component against its design.
Why use it?
It reduces repeated copying of visual values between design files and code and helps identify differences between the two.

Skill for Claude Code

Written for Claude Code: disable-model-invocation in frontmatter. Also seen: reads .claude/ paths; mentions OpenCode.

Good fit Use it to inspect Penpot components, sync values such as colours and spacing, create starter component files, or review an implemented component against its design.

Compare 6 skills from other repositories ↓
Install with agentmods
npx agentmods add skills/lync-cyber/cataforge/penpot-bridge
Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Any agent
npx skills add lync-cyber/CataForge --skill penpot-bridge
Clone the repo
git clone --depth 1 https://github.com/lync-cyber/CataForge

Made for: Claude Code.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for penpot-bridge

README.md
[![agentmods](https://agentmods.dev/badge/skills/lync-cyber/cataforge/penpot-bridge.svg)](https://agentmods.dev/skills/lync-cyber/cataforge/penpot-bridge)
Your own site
<a href="https://agentmods.dev/skills/lync-cyber/cataforge/penpot-bridge"><img src="https://agentmods.dev/badge/skills/lync-cyber/cataforge/penpot-bridge.svg" alt="Measured on agentmods" height="20"></a>
Per session 122 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 2,333 The whole file, excluding the scripts and references it only reads on demand.
Security scan B 1 finding. A grade says what 26 rules found in the file — not that it is safe.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00122 $0.02333
Opus 5 $0.00061 $0.01167
Sonnet 5 $0.00024 $0.00467
Haiku 4.5 $0.00012 $0.00233

Measured 8d ago against content hash 6f75e827c564, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-08, from the pricing page.

Security

Grade B, and why

penpot-bridge scanned grade B with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Reads MCP configurationmediumAgent snooping

mcp.json carries server URLs and auth tokens; reading it lets a mod discover and abuse other integrations.

具体 MCP 工具名以平台 MCP 配置为准(Claude: `.mcp.json` / `.claude/settings.json`;Cursor: `.cursor/mcp.json`;OpenCode: `opencode.json`),运行时按可用工具列表自动发现。典型操作:读项目信息、读组件结构/样式/SVG、读写设计 Token、导出组件图像(export_shape)。工具列表中无 Penpot 工具时先 `catafo
.cataforge/skills/penpot-bridge/SKILL.md · 93 lines

How it starts

The opening of the file, as written. The whole thing — 93 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Penpot 设计↔代码桥 (penpot-bridge)

能力边界

  • 能做: 读 Penpot 组件结构/样式/Token 实值;Token 双向同步(ui-spec ↔ Penpot ↔ tokens.css);从 Penpot 设计生成组件代码骨架;设计↔代码视觉一致性校验
  • 不做: 需求/架构/页面信息设计(由 ui-design 负责);业务逻辑/状态管理/API 对接(由 TDD GREEN 负责);修改 ui-spec 语义契约

权威划分(语义 vs 视觉实值)见 ui-spec 模板「权威源约定」。

前置条件(所有操作共用)

  • {INSTRUCTION_FILE} 设计工具 字段为 penpot
  • Penpot MCP 可用(见 §Penpot MCP 接入);不可用时返回 blocked,不静默 success

输入规范

  • read: UC-{NNN} 或 Penpot 组件名
  • sync: ui-spec#§1 设计系统 Token + sync-direction ∈ {emit, mirror, ingest}
  • generate: ui-spec#§2 UC-{NNN}(Props/变体/交互——语义)+ arch#§1.4 技术栈 + Penpot 组件设计数据(视觉,经 read)
  • verify: Penpot 组件设计数据(视觉权威源,经 read)+ 已实现组件代码路径 + ui-spec#§2 UC-{NNN}(语义参照)

输出规范

  • read: 组件层级结构 / CSS 属性 / Token 实值 + 组件导出图像(供其他操作复用)
  • sync: src/styles/tokens.css(W3C Design Tokens 格式)+ 同步差异报告
  • generate: 组件骨架文件(按 arch 技术栈)+ 样式文件(引 tokens.css 变量)
  • verify: 设计一致性审查报告 docs/reviews/design/DESIGN-REVIEW-{component_id}-r{N}.md(差异列表 + 修复建议)

Penpot MCP 接入

具体 MCP 工具名以平台 MCP 配置为准(Claude: .mcp.json / .claude/settings.json;Cursor: .cursor/mcp.json;OpenCode: opencode.json),运行时按可用工具列表自动发现。典型操作:读项目信息、读组件结构/样式/SVG、读写设计 Token、导出组件图像(export_shape)。工具列表中无 Penpot 工具时先 cataforge penpot ensure(若未部署则 cataforge penpot deploy),仍不可用返回 blocked。

Plugin API 已知限制

程序化操作 Penpot 时以下限制不可绕过:

  1. 跨页移动/克隆无效appendChild / insertChild 跨页静默 no-op(不抛错、返回成功但 shape 仍在原页),clone() 对非激活页 shape 返回 null,parent 只读;已有 board 无法编程搬到另一页,只能人工在 UI 剪切粘贴
  2. shape 变更仅对激活页生效 — 对非当前激活页 board 的属性赋值静默 no-op;页面切换跨执行异步(同一次执行内 currentPage 不切换),程序化建 board / 排版必须「openPage 目标页 → 下一次执行再变更」两段式
  3. 无删页 API — 空页/误建页无法编程删除,仅能人工在 UI 删或改名复用;建页前先确定页数清单,宁可复用/回收,不误建

Penpot 文件组织约定(一规格一页)

design_tool=penpot 时视觉稿 authoring 按 ui-spec 结构一规格一页建页:设计系统 / 各页面规格 P-NNN / 组件库分别落独立 Penpot 页面,board 创作期即落对页。Plugin API 无法事后无损重组(§Plugin API 已知限制),页面骨架必须在创作期先建好;退化路径(generateMarkup → SVG 重建)丢失 flex 布局、设计 Token、组件实例链接与文本可编辑性,不可作为重组手段。

操作指令

read

读 Penpot 设计数据,供 sync/generate/verify 复用或独立做视觉 grounding。

  1. 经 MCP 读取组件层级结构(容器/子元素/文本/图标)
  2. 提取 CSS 属性(尺寸/颜色/字体/间距/边框)与 Token 实值
  3. 映射到 tokens.css 设计变量(优先变量而非硬编码值)
  4. 经 MCP export_shape 导出目标组件图像,供调用方做视觉自检(设计决策 / 还原度核对)

Read the full file on GitHub · 93 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 8d ago First seen · 93 lines · 122 tokens per session scan B 6f75e827c564

Subscribe to this mod's changes

penpot-bridge is a skill published in the GitHub repository lync-cyber/CataForge (128 stars, last pushed 1mo ago), licensed MIT. It adds 122 tokens to every session and 2,333 once invoked, about $0.0006 per session on Opus 5. A static security scan graded it B with 1 finding (reads mcp configuration). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Related

Other skills, from other repositories

chakra-ui-builder

Build responsive, accessible UI components and layouts using Chakra UI v3, install or configure Chakra UI in new and existing projects, and design scalable themes using tokens, semantic tokens, recipes, and slot recipes. Use this skill whenever a user asks to build, create, or generate any UI component, page, form…

chakra-ui/chakra-ui · 214 tokens

visual-ralph

Visual Ralph orchestration for frontend UI from generated references, static references, or live URL targets, using $ralph with built-in visual verdict and pixel-diff evidence until the implementation matches and leaves a reproducible design system.

Yeachan-Heo/oh-my-codex · 50 tokens

frontend-visual-qa

Audits already-rendered web, landing-page, HTML deck/slide, browser tool/game, dashboard/admin, design-system, and desktop UIs using real-browser or native-app journeys, inspected screenshots, DOM geometry, responsive or projection viewports, and a bundled Playwright sweep. Use after UI implementation to find…

daymade/claude-code-skills · 145 tokens

prototype-web

A clickable, high-fidelity web product prototype with navigation, a hero section, feature cards, steps, social proof, and optional pricing. It is designed to resemble a finished landing page while remaining a prototype.

nexu-io/html-anything · 24 tokens

animation-principles

Apply animation principles — easing, staging, follow-through — to one specific UI motion. Use when tuning how an animation feels. For product-wide duration and easing tokens use motion-system (design-systems); for a full interaction spec use micro-interaction-spec.

Owl-Listener/designer-skills · 59 tokens

refactoring-ui

Audit and fix visual hierarchy, spacing, color, and depth in web UIs. Use when the user mentions "my UI looks off" (or amateur/unprofessional), "fix the design", "Tailwind styling", "color palette", "visual hierarchy", "design system", "spacing scale", or "component styling". Also trigger when building consistent…

wondelai/skills · 132 tokens